-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: UnixWare 7.1.3 Open UNIX 8.0.0 UnixWare 7.1.1 : Sendmail: buffer overflow in versions 8.12.9 and prior. Advisory number: CSSA-2003-SCO.23.1 Issue date: 2003 September 30 Cross reference: sr876458 fz527629 erg712276 CAN-2003-0694 CAN-2003-0681 CERT CA-2003-25 ______________________________________________________________________________ 1. Problem Description There is a remotely exploitable vulnerability in sendmail that could allow an attacker to gain control of a vulnerable sendmail server. Due to a variable type conversion problem (char to signed int), sendmail may not adequately check the length of address tokens. A specially crafted email message could trigger a stack overflow. This vulnerability was discovered by Michal Zalewski with a patch to fix the problem provided by Todd C. Miller of Courtesan Consulting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0694 and CAN-2003-0681 to this issue. CERT CA-2003-25 / CAN-2003-0694: The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. CAN-2003-0681: A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. 2. Vulnerable Supported Versions System Binaries ---------------------------------------------------------------------- UnixWare 7.1.3, Open UNIX 8.0.0, UnixWare 7.1.1 /etc/mail/cf/README /etc/mail/cf/README.SCO /etc/mail/cf/cf/Build /etc/mail/cf/cf/Makefile /etc/mail/cf/cf/README /etc/mail/cf/cf/chez.cs.mc /etc/mail/cf/cf/clientproto.mc /etc/mail/cf/cf/cs-hpux10.mc /etc/mail/cf/cf/cs-hpux9.mc /etc/mail/cf/cf/cs-osf1.mc /etc/mail/cf/cf/cs-solaris2.mc /etc/mail/cf/cf/cs-sunos4.1.mc /etc/mail/cf/cf/cs-ultrix4.mc /etc/mail/cf/cf/cyrusproto.mc /etc/mail/cf/cf/generic-bsd4.4.cf /etc/mail/cf/cf/generic-bsd4.4.mc /etc/mail/cf/cf/generic-hpux10.cf /etc/mail/cf/cf/generic-hpux10.mc /etc/mail/cf/cf/generic-hpux9.cf /etc/mail/cf/cf/generic-hpux9.mc /etc/mail/cf/cf/generic-linux.cf /etc/mail/cf/cf/generic-linux.mc /etc/mail/cf/cf/generic-mpeix.cf /etc/mail/cf/cf/generic-mpeix.mc /etc/mail/cf/cf/generic-nextstep3.3.cf /etc/mail/cf/cf/generic-nextstep3.3.mc /etc/mail/cf/cf/generic-osf1.cf /etc/mail/cf/cf/generic-osf1.mc /etc/mail/cf/cf/generic-solaris.cf /etc/mail/cf/cf/generic-solaris.mc /etc/mail/cf/cf/generic-sunos4.1.cf /etc/mail/cf/cf/generic-sunos4.1.mc /etc/mail/cf/cf/generic-ultrix4.cf /etc/mail/cf/cf/generic-ultrix4.mc /etc/mail/cf/cf/huginn.cs.mc /etc/mail/cf/cf/knecht.mc /etc/mail/cf/cf/mail.cs.mc /etc/mail/cf/cf/mail.eecs.mc /etc/mail/cf/cf/mailspool.cs.mc /etc/mail/cf/cf/python.cs.mc /etc/mail/cf/cf/s2k-osf1.mc /etc/mail/cf/cf/s2k-ultrix4.mc /etc/mail/cf/cf/sco.uw.svr5.cf /etc/mail/cf/cf/sco.uw.svr5.mc /etc/mail/cf/cf/submit.cf /etc/mail/cf/cf/submit.mc /etc/mail/cf/cf/tcpproto.mc /etc/mail/cf/cf/ucbarpa.mc /etc/mail/cf/cf/ucbvax.mc /etc/mail/cf/cf/uucpproto.mc /etc/mail/cf/cf/vangogh.cs.mc /etc/mail/cf/domain/Berkeley.EDU.m4 /etc/mail/cf/domain/CS.Berkeley.EDU.m4 /etc/mail/cf/domain/EECS.Berkeley.EDU.m4 /etc/mail/cf/domain/S2K.Berkeley.EDU.m4 /etc/mail/cf/domain/berkeley-only.m4 /etc/mail/cf/domain/generic.m4 /etc/mail/cf/feature/accept_unqualified_senders.m4 /etc/mail/cf/feature/accept_unresolvable_domains.m4 /etc/mail/cf/feature/access_db.m4 /etc/mail/cf/feature/allmasquerade.m4 /etc/mail/cf/feature/always_add_domain.m4 /etc/mail/cf/feature/authinfo.m4 /etc/mail/cf/feature/bestmx_is_local.m4 /etc/mail/cf/feature/bitdomain.m4 /etc/mail/cf/feature/blacklist_recipients.m4 /etc/mail/cf/feature/compat_check.m4 /etc/mail/cf/feature/delay_checks.m4 /etc/mail/cf/feature/dnsbl.m4 /etc/mail/cf/feature/domaintable.m4 /etc/mail/cf/feature/enhdnsbl.m4 /etc/mail/cf/feature/generics_entire_domain.m4 /etc/mail/cf/feature/genericstable.m4 /etc/mail/cf/feature/ldap_routing.m4 /etc/mail/cf/feature/limited_masquerade.m4 /etc/mail/cf/feature/local_lmtp.m4 /etc/mail/cf/feature/local_no_masquerade.m4 /etc/mail/cf/feature/local_procmail.m4 /etc/mail/cf/feature/lookupdotdomain.m4 /etc/mail/cf/feature/loose_relay_check.m4 /etc/mail/cf/feature/mailertable.m4 /etc/mail/cf/feature/masquerade_entire_domain.m4 /etc/mail/cf/feature/masquerade_envelope.m4 /etc/mail/cf/feature/msp.m4 /etc/mail/cf/feature/no_default_msa.m4 /etc/mail/cf/feature/nocanonify.m4 /etc/mail/cf/feature/nodns.m4 /etc/mail/cf/feature/notsticky.m4 /etc/mail/cf/feature/nouucp.m4 /etc/mail/cf/feature/nullclient.m4 /etc/mail/cf/feature/preserve_local_plus_detail.m4 /etc/mail/cf/feature/preserve_luser_host.m4 /etc/mail/cf/feature/promiscuous_relay.m4 /etc/mail/cf/feature/queuegroup.m4 /etc/mail/cf/feature/redirect.m4 /etc/mail/cf/feature/relay_based_on_MX.m4 /etc/mail/cf/feature/relay_entire_domain.m4 /etc/mail/cf/feature/relay_hosts_only.m4 /etc/mail/cf/feature/relay_local_from.m4 /etc/mail/cf/feature/relay_mail_from.m4 /etc/mail/cf/feature/smrsh.m4 /etc/mail/cf/feature/stickyhost.m4 /etc/mail/cf/feature/use_ct_file.m4 /etc/mail/cf/feature/use_cw_file.m4 /etc/mail/cf/feature/uucpdomain.m4 /etc/mail/cf/feature/virtuser_entire_domain.m4 /etc/mail/cf/feature/virtusertable.m4 /etc/mail/cf/hack/cssubdomain.m4 /etc/mail/cf/m4/cf.m4 /etc/mail/cf/m4/cfhead.m4 /etc/mail/cf/m4/proto.m4 /etc/mail/cf/m4/version.m4 /etc/mail/cf/mailer/cyrus.m4 /etc/mail/cf/mailer/cyrusv2.m4 /etc/mail/cf/mailer/fax.m4 /etc/mail/cf/mailer/local.m4 /etc/mail/cf/mailer/mail11.m4 /etc/mail/cf/mailer/phquery.m4 /etc/mail/cf/mailer/pop.m4 /etc/mail/cf/mailer/procmail.m4 /etc/mail/cf/mailer/qpage.m4 /etc/mail/cf/mailer/smtp.m4 /etc/mail/cf/mailer/usenet.m4 /etc/mail/cf/mailer/uucp.m4 /etc/mail/cf/ostype/a-ux.m4 /etc/mail/cf/ostype/aix3.m4 /etc/mail/cf/ostype/aix4.m4 /etc/mail/cf/ostype/aix5.m4 /etc/mail/cf/ostype/altos.m4 /etc/mail/cf/ostype/amdahl-uts.m4 /etc/mail/cf/ostype/bsd4.3.m4 /etc/mail/cf/ostype/bsd4.4.m4 /etc/mail/cf/ostype/bsdi.m4 /etc/mail/cf/ostype/bsdi1.0.m4 /etc/mail/cf/ostype/bsdi2.0.m4 /etc/mail/cf/ostype/darwin.m4 /etc/mail/cf/ostype/dgux.m4 /etc/mail/cf/ostype/domainos.m4 /etc/mail/cf/ostype/dynix3.2.m4 /etc/mail/cf/ostype/freebsd4.m4 /etc/mail/cf/ostype/freebsd5.m4 /etc/mail/cf/ostype/gnu.m4 /etc/mail/cf/ostype/hpux10.m4 /etc/mail/cf/ostype/hpux11.m4 /etc/mail/cf/ostype/hpux9.m4 /etc/mail/cf/ostype/irix4.m4 /etc/mail/cf/ostype/irix5.m4 /etc/mail/cf/ostype/irix6.m4 /etc/mail/cf/ostype/isc4.1.m4 /etc/mail/cf/ostype/linux.m4 /etc/mail/cf/ostype/maxion.m4 /etc/mail/cf/ostype/mklinux.m4 /etc/mail/cf/ostype/mpeix.m4 /etc/mail/cf/ostype/nextstep.m4 /etc/mail/cf/ostype/openbsd.m4 /etc/mail/cf/ostype/osf1.m4 /etc/mail/cf/ostype/powerux.m4 /etc/mail/cf/ostype/ptx2.m4 /etc/mail/cf/ostype/qnx.m4 /etc/mail/cf/ostype/riscos4.5.m4 /etc/mail/cf/ostype/sco-uw-2.1.m4 /etc/mail/cf/ostype/sco.uw.svr5.m4 /etc/mail/cf/ostype/sco3.2.m4 /etc/mail/cf/ostype/sinix.m4 /etc/mail/cf/ostype/solaris2.m4 /etc/mail/cf/ostype/solaris2.ml.m4 /etc/mail/cf/ostype/solaris2.pre5.m4 /etc/mail/cf/ostype/solaris8.m4 /etc/mail/cf/ostype/sunos3.5.m4 /etc/mail/cf/ostype/sunos4.1.m4 /etc/mail/cf/ostype/svr4.m4 /etc/mail/cf/ostype/ultrix4.m4 /etc/mail/cf/ostype/unixware7.m4 /etc/mail/cf/ostype/unknown.m4 /etc/mail/cf/ostype/uxpds.m4 /etc/mail/cf/sendmail.schema /etc/mail/cf/sh/makeinfo.sh /etc/mail/cf/siteconfig/uucp.cogsci.m4 /etc/mail/cf/siteconfig/uucp.old.arpa.m4 /etc/mail/cf/siteconfig/uucp.ucbarpa.m4 /etc/mail/cf/siteconfig/uucp.ucbvax.m4 /etc/mail/convertcf /etc/mail/mailstats /etc/mail/makemap /etc/mail/praliases /etc/mail/sendmail.hf /etc/mail/sendmailcf.factory /etc/mail/sendmailrc /etc/mail/smrsh /usr/bin/rmail /usr/lib/mail/execmail /usr/lib/sendmail 3. Solution The proper solution is to install the latest packages. 4. UnixWare 7.1.3 / Open UNIX 8.0.0 / UnixWare 7.1.1 4.1 Location of Fixed Binaries ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.23 4.2 Verification MD5 (erg712433.Z) = 67be4523e9286555bc3fbf1a51a6d72c md5 is available for download from ftp://ftp.sco.com/pub/security/tools 4.3 Installing Fixed Binaries Upgrade the affected binaries with the following sequence: 1. Download the erg712433.Z file to the /tmp directory on your machine. 2. As root, uncompress the file and add the package to your system using these commands: $ su Password: # uncompress /tmp/erg712433.Z # pkgadd -d /tmp/erg712433 # rm /tmp/erg712433 5. References Specific references for this advisory: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0694 http://www.cert.org/advisories/CA-2003-12.html http://www.cert.org/advisories/CA-2003-25.html http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0681 http://www.sendmail.org/8.12.10.html http://marc.theaimsgroup.com/?l=bugtraq&m=106383437615742&w=2 http://marc.theaimsgroup.com/?l=bugtraq&m=106398718909274&w=2 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr876458 fz527629 erg712276. 6. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 7. Acknowledgments SCO would like to thank Michal Zalewski for notifying Sendmail, Inc., and the Sendmail Consortium. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (SCO/UNIX_SVR5) iD8DBQE/ejvuaqoBO7ipriERAuV8AJwNPVSVPdyRJuH+PW/YKDEiGcJdZACdFfo7 JySa/5SqAZHJMU+pACSz1Ug= =Pq3H -----END PGP SIGNATURE-----